From 1e37926ee9cfe90b71470160079a2df929553ee2 Mon Sep 17 00:00:00 2001 From: Jakub Zych Date: Mon, 19 Oct 2026 19:28:09 +0200 Subject: [PATCH] docs(19.4-02): record plan state and roadmap progress --- .planning/ROADMAP.md | 6 +++--- .planning/STATE.md | 19 ++++++++++++------- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/.planning/ROADMAP.md b/.planning/ROADMAP.md index 92f39c34..3eb52b0a 100644 --- a/.planning/ROADMAP.md +++ b/.planning/ROADMAP.md @@ -1299,14 +1299,14 @@ Plans: 4. An existing issuer, its signing keys and client secrets can be imported so that relying parties keep working. The phase gets a security review. 5. The `wristband` README and `docs/` pages are updated. The new code has unit tests, delivered in the phase's last plan. -**Plans:** 1/4 plans executed +**Plans:** 2/4 plans executed Plans: **Wave 1** - [x] 19.4-01-PLAN.md — Decision note (golang-jwt v5, zitadel rejected), then the wristband OIDC flavour: discovery, JWKS, resumable authorize with consent and switch account, token with id_token, userinfo, pairwise subjects, kinds, opt-in refresh; neutral Resource default; README and docs (wave 1) **Wave 2** *(blocked on Wave 1 completion)* -- [ ] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2) +- [x] 19.4-02-PLAN.md — New repo sm-oauthserver-plugin: migrations, GORM stores for OIDC and MCP, DB key ring, PHP-path routes and throttles, branded consent and error pages, authorizations JSON, user cascade, additive sm-user-plugin exports, go-oidc interop test (wave 2) **Wave 3** *(blocked on Wave 2 completion)* - [ ] 19.4-03-PLAN.md — Winter import with original kids, cabana Clients and Branding screens, rotate-keys, prune and schedule, tide parity against the PHP plugin, security review (wave 3) @@ -1468,7 +1468,7 @@ Phases execute in numeric order: 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → | 19. Chat and ChatChannels | 7/7 | Complete | 2026-10-17 | | 19.1. Chat satellites | 6/6 | Complete | 2026-10-18 | | 19.3. Framework transport and infrastructure for WavePath | 6/6 | In Progress| | -| 19.4. OIDC provider on wristband | 1/4 | In Progress| | +| 19.4. OIDC provider on wristband | 2/4 | In Progress| | | 19.5. Social login in sm-user-plugin | 0/TBD | Not started | - | | 19.6. Two-factor auth and device flow in sm-user-plugin | 0/TBD | Not started | - | | 19.7. Generic MCP module | 0/TBD | Not started | - | diff --git a/.planning/STATE.md b/.planning/STATE.md index 9fe78b93..adcb8011 100644 --- a/.planning/STATE.md +++ b/.planning/STATE.md @@ -4,16 +4,16 @@ milestone: v1.0 current_phase: "19.4" current_phase_name: OIDC provider on wristband (INSERTED) status: executing -stopped_at: Completed 19.4-01-PLAN.md -last_updated: "2026-10-19T16:36:07.503Z" +stopped_at: Completed 19.4-02-PLAN.md +last_updated: "2026-10-19T17:27:50.200Z" last_activity: 2026-10-19 last_activity_desc: Phase 19.4 execution started -state_head: 49e772afb8503401ecdd05731e92be52fb233dd1 +state_head: 8171eb25efc1ab4ad298338bbffd8598a7dc2c69 progress: total_phases: 42 completed_phases: 34 total_plans: 208 - completed_plans: 205 + completed_plans: 206 gsd_state_version: "1.0" milestone_name: milestone --- @@ -30,7 +30,7 @@ See: .planning/PROJECT.md (updated 2026-10-12) ## Current Position Phase: 19.4 (OIDC provider on wristband (INSERTED)) — EXECUTING -Plan: 2 of 4 +Plan: 3 of 4 Status: Ready to execute Last activity: 2026-10-19 — Phase 19.4 execution started @@ -259,6 +259,7 @@ Progress: [████████░░] 83% | Phase 19.1 P19.1-02 | 9 min | 4 tasks | 36 files | | Phase 19.1 P19.1-06 | 16 | 3 tasks | 46 files | | Phase 19.4 P01 | 28 min | 4 tasks | 34 files | +| Phase 19.4 P02 | 50min | 5 tasks | 54 files | ## Accumulated Context @@ -877,6 +878,10 @@ Recent decisions affecting current work: - [Phase 19.4]: D-16: extend the hand-written wristband with an OIDC flavour; golang-jwt/jwt/v5 v5.3.1 signs id_tokens via MapClaims; stdlib JWKs; zitadel/oidc v3 rejected; go-oidc and x/oauth2 test-only in sm-oauthserver-plugin - [Phase 19.4]: 19.4-01: OIDC redirects send Cache-Control no-store, private (plan) while PHP sends no-cache, private; plan 03 tide replay settles it - [Phase 19.4]: 19.4-01: wristband DefaultOptions().Resource is empty; host applications set their MCP resource explicitly (fonoteka 687e25a) +- [Phase 19.4]: 19.4-02: go-oidc v3.21.0 and x/oauth2 v0.37.0 approved as test-only requirements of sm-oauthserver-plugin (TestRelyingPartyInterop, RS256 and ES256) +- [Phase 19.4]: 19.4-02: first signing key via INSERT ... ON CONFLICT (active) WHERE active DO NOTHING with a silent GORM logger so key ciphertext never reaches the log +- [Phase 19.4]: 19.4-02: plugin-owned oauthserver.body.limit middleware on the token routes because surf ignores body.limit on GroupRaw routes +- [Phase 19.4]: 19.4-02: SanitizeCustomCSS repeats tag-opener removal until stable (PHP single pass is bypassable) ### Pending Todos @@ -964,6 +969,6 @@ Items acknowledged and carried forward from previous milestone close: ## Session Continuity -Last session: 2026-10-19T16:36:06.663Z -Stopped at: Completed 19.4-01-PLAN.md +Last session: 2026-10-19T17:27:49.408Z +Stopped at: Completed 19.4-02-PLAN.md Resume file: None